Guidance

Changing Futures research: privacy notice

Updated 9 January 2025

Applies to England

The following is to explain your rights and give you the information you are entitled to under UK data protection legislation.

1. The identity and contact details of the Ministry of Housing, Communities and Local Government (MHCLG) and our Data Protection Officer   

MHCLG is the data controller. The Data Protection Officer can be contacted at dataprotection@communities.gov.uk

2. What personal data we are collecting and why  

Your personal data is being collected to help us understand how well services for people who might be facing a range of issues such as homelessness, mental health issues and substance misuse, are working. These services are part of a programme called Changing Futures.

The following personal data is being collected for this purpose:

• Special Category (SC) data: Information about your ethnicity, nationality, religion, sexual orientation, mental and physical health, wellbeing, drug and alcohol use and use of healthcare services. This information is reported by you and is not compulsory.
• Criminal Offence (CO) data: Experience of prison and recent criminal justice interactions. This information is reported by you and is not compulsory.
• Personal identifiers such as your name, telephone numbers, e-mail address, address, date of birth, gender and national insurance number.

The special category and criminal offence data will help researchers understand what impact Changing Futures has had on individuals compared to others who have similar profiles but have not been part of Changing Futures. If you agree to data linking, personal identifiers will provide researchers with a way to match data across a range of administrative datasets.

3. Lawful basis for processing the data 

The data protection legislation sets out when we are lawfully allowed to process your data. The lawful basis that applies to this processing is Article 6(1) of the UK GDPR:

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

‘Special Category’ data is personal data deemed to be more sensitive by law, and so needs additional protection.

The processing of special category data meets the requirement of article 9(2) of the UK GDPR.

(g) processing is necessary for reasons of substantial public interest, on the basis of Domestic Law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject

MHCLG will rely on meeting the condition in Schedule 1, Part 2, paragraph 6 of the DPA 2018 in order to process special category personal data in accordance with section 10(3) of the DPA 2018. This condition is met since the processing is necessary for exercising a function of a government department and is necessary for reasons of substantial public interest. An Appropriate Policy Document is in place in accordance to meet the condition in schedule 1, part 4.

4. With whom we will be sharing the data

We may share your personal identifiers with other government agencies, so that they can share information such as your benefits, any offending behaviour, and your health and health service use, with us.

This includes, but is not limited to:

• the Department for Work and Pensions (DWP) on any benefits you receive
• National Health Service Digital (NHS Digital) on your health and use of health care services
• Public Health England (PHE) on your use of any substance misuse services
• Ministry of Justice (MoJ) on any offending behaviour
• Office for National Statistics (ONS) so that other government departments and research organisations can access your anonymised data (you cannot be identified)

We use all this information about you and other people to help us understand how well the Changing Futures services are working. It will help shape what services are available in future but will not affect any of the services or benefits you receive now.

Research contractors who are working for us will be receiving all your information except for your personal identifiers. They won’t know whose information they are looking at, but they will tell us how well the services are working for people. The data will be what is known as ‘pseudonymised’. Some of this data may be shared with their sub-contractors to carry out research.

MHCLG will receive your personal identifiers and share these with other government agencies who will then match their data to yours. MHCLG will hold your personal identifiers securely. Before any linked datasets are shared with MHCLG and analysed your personal identifiers will be removed creating a ‘pseudonymised’ dataset.

5. For how long we will keep the personal data, or criteria used to determine the retention period.

Your personal data will be held only for as long as it is needed for the research. This will be until 5 years from data collection to allow for longitudinal research, reviewed annually and deleted sooner if no longer needed. CFE Research ltd will retain datasets until six months after evaluation end. De-identified datasets will be reviewed by MHCLG annually to ensure data is being held for the right reasons.

6. Your rights, for example access, rectification, erasure 

The data we are collecting is your personal data, and you have rights that affect what happens to it. You have the right to:

1. know that we are using your personal data 2. see what data we have about you 3. ask to have your data corrected, and to ask how we check the information we hold is accurate 4. complain to the ICO (see below)

7. Sending data overseas

Your personal data will not be sent overseas.

8. Automated decision making

We will not use your data for any automated decision making.

9. Storage, security and data management

Your personal data will be stored in a secure government IT system. Your information is securely stored in the UK.

10. Complaints and more information

When we ask you for information, we will keep to the law, including the Data Protection Act 2018 and UK General Data Protection Regulation.

If you are unhappy with the way the Department has acted, you can make a complaint.

If you are not happy with how we are using your personal data, you should first contact dataprotection@communities.gov.uk.

If you are still not happy, or for independent advice about data protection, privacy and data sharing, you can contact:

The Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow, Cheshire
SK9 5AF

Telephone: 0303 123 1113 or 01625 545 745

https://ico.org.uk/